Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    12733f995ba05a3fac496e95cdcdb013_JaffaCakes118

  • Size

    544KB

  • Sample

    240626-sq294szfpg

  • MD5

    12733f995ba05a3fac496e95cdcdb013

  • SHA1

    6cdd41f788c984bddf8691af09fd67e2317c2302

  • SHA256

    78f4412b5ce4aca748096baf19f05130b7e9f64b9949397ffc68959e62462e6c

  • SHA512

    76fbdb470649d70b89d36332bf2d47bc352c89a099292b0a640c75d046b24d26538eb766bc3a3f95222cf554c25237b35b41079e94c9c606cd98de2c6f6f562d

  • SSDEEP

    6144:hIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUmkjP:hIXsgtvm1De5YlOx6lzBH46U

Malware Config

Targets

    • Target

      12733f995ba05a3fac496e95cdcdb013_JaffaCakes118

    • Size

      544KB

    • MD5

      12733f995ba05a3fac496e95cdcdb013

    • SHA1

      6cdd41f788c984bddf8691af09fd67e2317c2302

    • SHA256

      78f4412b5ce4aca748096baf19f05130b7e9f64b9949397ffc68959e62462e6c

    • SHA512

      76fbdb470649d70b89d36332bf2d47bc352c89a099292b0a640c75d046b24d26538eb766bc3a3f95222cf554c25237b35b41079e94c9c606cd98de2c6f6f562d

    • SSDEEP

      6144:hIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUmkjP:hIXsgtvm1De5YlOx6lzBH46U

    • Modifies WinLogon for persistence

    • UAC bypass

    • Adds policy Run key to start application

    • Disables RegEdit via registry modification

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Impair Defenses: Safe Mode Boot

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks